AlwaysMys

The majority of the community is grossly miseducated when it comes to API scams, and it's not fully their fault. API SCAMS HAVE NOTHING TO DO WITH YOUR API KEY. Thought they did? Then keep reading. Quite some time ago, your API key was involved in API scams, hence the name, but currently your API key provide any information regarding your CS2 inventory, nor provide a way to interact with it. So how do API/Phishing scams work? A scammer acquires your Steam login information by convincing you to "log into" a phishing site. They use your login details to log into your account, and you confirm it thinking you are the one initiating the confirmation. They obtain your access and refresh token, and create a session with your Steam account. With this, they have full access to your steam account. The scammer lays dormant in your account (keeping their session through your refresh token) until you send a one-sided trade offer. They immediately cancel it, and send a new one to their account, which you confirm thinking it's the offer YOU sent. Then your items are gone. How do I prevent myself from logging in to phishing sites? This is far easier than you would think. Firstly, log into the official Steam website (steamcommunity.com) in on browser. Then, visit any site you want to use, and click "Login". If the site creates a popup that asks you for your Steam username and passcode, it is a SCAM SITE. If the site redirects to a page that does not require you to enter your Steam username and passcode, but rather has a green button that says "Sign In", it is not a Phishing site. Legit sites use OpenID (partner.steamgames.com/doc/f…) as the login validator for your Steam Account. If you're logged into Steam on your browser, no legit site needs your username and passcode, because OpenID is able to manage your Steam credentials. It's that simple. What do I do if my account is compromised? This is easy too! You just need to disrupt the scammer's session, and make sure they can't create a new one. Here are the steps: 1.) Deauthorize logins <store.steampowered.com/twofa…> 2.) Change password 3.) Deauthorize logins again <store.steampowered.com/twofa…> The most dangerous part of API scams is the fact that people don't know how they work. Once you have the correct information about them, keeping your account safe from this sort of scam is easy. I've written an anti-scam guide with details about many other scams besides the API scam. I think it's very worth reading: docs.google.com/document/d/1… If you've read this far, thank you. A random retweet will win a skin ❤️